Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
XCMS 1.1 - 'Galerie.php' Local File Inclusion
Multiple directory traversal vulnerabilities in Module/Galerie.php in XCMS 1.1 allow remote attackers to include and exe
23RISK
open ↗Referência✓ VexDay Proof
PHPortal 1.0 - Insecure Cookie Handling
uye_paneli.php in phPortal 1.0 allows remote attackers to bypass authentication and obtain administrative access by sett
23RISK
open ↗Referência✓ VexDay Proof
FTP Explorer 1.0.1 Build 047 - Remote CPU Consumption (Denial of Service)
FTP Explorer 1.0.1 Build 047, and other versions before 1.0.1.52, allows remote servers to cause a denial of service (CP
23RISK
open ↗Referência✓ VexDay Proof
WebText 0.4.5.2 - Remote Code Execution
Direct static code injection vulnerability in WebText CMS 0.4.5.2 and earlier allows remote attackers to inject arbitrar
23RISK
open ↗Referência✓ VexDay Proof
empris r20020923 - 'phormationdir' Remote File Inclusion
PHP remote file inclusion vulnerability in sql_fcnsOLD.php in Emergenices Personnel Information System (Empris) 20020923
23RISK
open ↗Referência✓ VexDay Proof
AJSquare Free Polling Script - 'DB' Multiple Vulnerabilities
AJ Square Free Polling Script (AJPoll) Database version allows remote attackers to bypass authentication and reset poll
23RISK
open ↗Referência✓ VexDay Proof
WebBiscuits Modules Controller 1.1 - Remote File Inclusion / Remote File Disclosure
PHP remote file inclusion vulnerability in adminhead.php in WebBiscuits Modules Controller 1.1 and earlier allows remote
23RISK
open ↗Referência✓ VexDay Proof
Simple Customer 1.2 - 'contact.php' SQL Injection
SQL injection vulnerability in contact.php in Simple Customer 1.2 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Referência✓ VexDay Proof
The Everything Development System Pre-1.0 - SQL Injection
The Everything Development Engine in The Everything Development System Pre-1.0 and earlier stores passwords in cleartext
23RISK
open ↗Referência✓ VexDay Proof
hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities
Unspecified vulnerability in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to enable
23RISK
open ↗Referência✓ VexDay Proof
BXCP 0.3.0.4 - 'where' SQL Injection
SQL injection vulnerability in the files mod in index.php in BXCP 0.3.0.4 allows remote attackers to execute arbitrary S
23RISK
open ↗Referência✓ VexDay Proof
Mambo Module galleria 1.0b - Remote File Inclusion
PHP remote file inclusion vulnerability in galleria.html.php in Galleria Mambo Module 1.0 and earlier for Mambo allows r
23RISK
open ↗Referência✓ VexDay Proof
WonderEdit Pro CMS (template_path) - Remote File Inclusion
PHP remote file inclusion vulnerability in WonderEdit Pro CMS allows remote attackers to execute arbitrary PHP code via
23RISK
open ↗Referência✓ VexDay Proof
ABC-View Manager 1.42 - '.psp' Local Buffer Overflow
Buffer overflow in ABC-View Manager 1.42 allows user-assisted remote attackers to execute arbitrary code via a crafted .
23RISK
open ↗Referência✓ VexDay Proof
EQdkp 1.3.1 - 'Referer Spoof' Remote Database Backup
EQdkp 1.3.1 and earlier authenticates administrative requests by verifying that the HTTP Referer header specifies an adm
23RISK
open ↗Referência✓ VexDay Proof
inertianews 0.02b - 'inertianews_main.php' Remote File Inclusion
PHP remote file inclusion vulnerability in inertianews_main.php in inertianews 0.02 beta allows remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
CubeCart 3.0.6 - Remote Command Execution
PHP remote file include vulnerability in includes/orderSuccess.inc.php in CubeCart allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component JoomlaDate 1.2 - 'user' SQL Injection
SQL injection vulnerability in the JoomlaDate (com_joomladate) component 1.2 for Joomla! allows remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
Apache Tomcat < 6.0.18 - 'utf8' Directory Traversal (PoC)
Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16,
60RISK
open ↗Referência✓ VexDay Proof
X7 Chat 2.0.5 - 'day' SQL Injection
SQL injection vulnerability in index.php in X7 Chat 2.0.5 and possibly earlier allows remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
Flat PHP Board 1.2 - Multiple Vulnerabilities
Direct static code injection vulnerability in index.php in Flat PHP Board 1.2 and earlier allows remote attackers to inj
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Windows - GDI+ '.ICO' File Remote Denial of Service
Microsoft Windows Graphics Device Interface (GDI+, GdiPlus.dll) allows context-dependent attackers to cause a denial of
28RISK
open ↗Referência✓ VexDay Proof
Cahier de texte 2.2 - Bypass General Access Protection
administration/index.php in Cahier de texte (CDT) 2.2 does not properly exit when authentication fails, which allows rem
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component pc_cookbook 0.3 - Remote File Inclusion
PHP remote file inclusion vulnerability in com_pccookbook/pccookbook.php in the PccookBook Component for Mambo and Jooml
23RISK
open ↗Referência✓ VexDay Proof
PAPOO 3_RC3 - SQL Injection / Admin Credentials Disclosure
SQL injection vulnerability in forumthread.php in Papoo 3 RC3 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗Referência✓ VexDay Proof
ASP Stats Generator 2.1.1 - SQL Injection
SQL injection vulnerability in pages.asp in ASP Stats Generator before 2.1.2 allows remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
Natterchat 1.12 - Database Disclosure
Natterchat 1.12 stores sensitive information under the web root with insufficient access control, which allows remote at
23RISK
open ↗Referência✓ VexDay Proof
realm CMS 2.3 - Multiple Vulnerabilities
_RealmAdmin/login.asp in Realm CMS 2.3 and earlier allows remote attackers to bypass authentication and access admin pag
23RISK
open ↗Referência✓ VexDay Proof
Prozilla Topsites 1.0 - Arbitrary Edit/Add Users
Prozilla Topsites 1.0 allows remote attackers to perform administrative actions via a direct request to (1) addu.php, (2
23RISK
open ↗Referência✓ VexDay Proof
hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities
Unspecified vulnerability in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to uninsta
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.